Gnosis Pay, a fintech project from Britain, officially confirmed that data belonging to holders of its retail Visa debit cards was compromised. The breach which took place on November 3 continues the trend of this fall, when attackers no longer need to go after blockchains or smart contracts. It’s far easier for them to hit the traditional fiat infra that links digital assets to the real world.
Institutional partners and investors can exhale as the company’s enterprise and white-label B2B platform is running normally. For ordinary users, the key point is that the crypto in their wallets is safe, as the company said funds were not affected either. Card issuer Monavate Limited, which is regulated by the UK’s Financial Conduct Authority, continues to operate as well. The hackers walked away with data only.
This time the unauthorized access involved a legacy B2C card processing system. The Gnosis Pay platform was already being prepared for retirement, with a full shutdown scheduled for December 20. According to the official explanation, after the hack happened, Gnosis Pay’s security team moved fast to contain the threat and cut off access via the compromised keys within two hours.
The crypto is safe, but the data is gone. What comes next
The Gnosis Pay incident rounds out a trilogy of major leaks this fall and exposes a weak spot shared by crypto-fiat gateways. The timeline of the past few weeks points to a clear pattern evident in Ledger, Trezor, SafePal and Keystone leaks throughout 2026.
Gnosis Pay has finished emailing affected users with a detailed list of the exposed data. Until the system goes offline next month, the company is operating in emergency mode with transaction monitoring being upped, and 3D Secure verification is now mandatory for all online payments.
Of course, the company has also issued an urgent phishing alert. Armed with purchase details, addresses and personal data, scammers are already starting to pose as official customer support. The Gnosis Pay team urges users to be suspicious of all incoming requests and reminds them that “we and our Partner Apps will never ask” for security credentials such as seed phrases, private keys, PINs or full card numbers to verify or cancel transactions. Finally, any account changes are legitimate only when users make them directly within the official app.
